MASTER PARTNER AGREEMENT

BouncePay — Master Partner Agreement (Key Terms)

BouncePay entity: B2M Holdings Ltd, incorporated in Cyprus under number HE 482468, trading as BouncePay, registered office 49 Anex, Moni, Limassol, Cyprus. Initial term: 12 months, continuing thereafter until terminated in accordance with this Agreement. Governing law: laws of the Republic of Cyprus. Banxa is not a party to this Agreement.

Background and agreement structure

BouncePay operates a technical integration and orchestration service through which an approved customer may access a hosted checkout and crypto-asset purchase service supplied by Banxa or another approved Provider.

The Partner wishes to make the Services available for its own Approved Business or, where expressly approved as a PSP / Aggregator, to Approved Submerchants.

This Agreement comprises the main terms and its schedules, including the applicable Partner-Type Terms, each Approved Merchant Profile, the Acceptable Use and Data Protection Schedule, the Commercial Terms and the versioned Global Pricing Schedule identified in Schedule 5. Schedule 5 and the Global Pricing Schedule prevail on pricing only; the applicable Partner-Type Terms prevail on matters specific to that Partner type.

Appointment and scope

BouncePay appoints the Partner on a non-exclusive and non-transferable basis to access the Services solely for the Approved Business and subject to this Agreement.

BouncePay provides technical access and orchestration only. Unless expressly agreed in writing, BouncePay is not the merchant of record, card acquirer, issuer, bank, crypto custodian, investment adviser or provider of the underlying goods or services.

The Customer contracts directly with the relevant Provider for the Provider transaction and separately with the Partner or Approved Submerchant for the underlying goods or services. The Partner must not describe BouncePay or Banxa as guaranteeing, endorsing or supplying those goods or services. The Partner receives no exclusivity, minimum volume, guaranteed acceptance rate or guaranteed availability.

Partner classification and portfolio responsibility

The Partner type selected in Schedule 1 determines which Partner-Type Schedule applies. A Direct Merchant may submit Transactions only for its own Approved Business and may not introduce, process for or provide access to another merchant, platform, affiliate or aggregator.

A PSP / Aggregator may introduce only Approved Submerchants and remains fully responsible for each Approved Submerchant, website, Customer journey and Transaction as if the relevant act or omission were its own. Each Approved Submerchant must be bound by terms no less protective of BouncePay than this Agreement.

No Partner may permit nested aggregation, undisclosed sub-processing, credential sharing, resale of API access or transaction laundering without BouncePay's prior written approval.

Onboarding and approval

The Partner must provide complete, accurate and current onboarding information, including ownership, licences, policies, websites, product descriptions, expected volumes, transaction values, countries, customer profile, source of traffic and requested wallet or settlement structure.

Approval is specific to the legal entity, domain, application, product, country, flow and transaction profile approved by BouncePay. Silence, technical enablement or prior processing does not constitute approval of a change. Prior written approval is required before adding or changing any merchant, domain, product, business model, beneficiary wallet, country, traffic source, ownership, licence status, material supplier or transaction profile.

BouncePay may refuse approval or impose conditions in its reasonable risk discretion, including transaction limits, enhanced monitoring, a reserve or security deposit.

Integration and Customer journey

The Partner must implement the Services strictly in accordance with current documentation and BouncePay's written instructions. API credentials must be protected, used only for the Approved Business and never disclosed to an unauthorised person.

The Partner must use the approved hosted checkout and must not remove, obscure, contradict or manipulate any disclosure identifying the Provider, the crypto-asset purchase, applicable fees, exchange rate, wallet destination, cancellation position or applicable Provider terms.

Before submitting a Transaction, the Partner must ensure the Customer understands that the payment funds a Provider crypto-asset transaction and that executed blockchain transfers may be irreversible. The Partner must obtain all consents required for Customer data to be transmitted to BouncePay, the Provider and their verification or payment suppliers, and must make no representation about regulation, licensing, guaranteed settlement, acceptance, refunds, investment performance or the legal status of crypto assets unless approved in writing.

Transaction and wallet instructions

The Partner is responsible for the accuracy, authenticity and completeness of every order parameter and instruction it supplies, including amount, currency, Customer details, merchant reference, redirect URL, wallet address, network and beneficiary allocation.

Only wallet and beneficiary structures expressly approved by BouncePay and the Provider may be used; a wallet may not be substituted or redirected without prior written approval. The Partner warrants lawful authority to use each wallet address and that the address supports the relevant asset and network.

The Partner bears Losses arising from inaccurate, compromised or unauthorised instructions supplied by it or its Partner Portfolio, except to the extent caused directly by BouncePay's proven processing error.

Compliance and prohibited activity

The Partner and Partner Portfolio must comply with applicable law, licence conditions, sanctions, AML and counter-terrorist-financing requirements, consumer law, advertising standards, card-network rules, applicable Provider terms and the Acceptable Use Policy.

The Partner must not submit or permit Transactions involving fraud, attempted fraud, stolen payment instruments, impersonation, sanctions evasion, money laundering, unlawful gambling, illegal goods, misleading investment activity, prohibited adult activity, transaction laundering or any other prohibited or undisclosed activity.

Appropriate onboarding, sanctions screening, transaction monitoring, complaint handling, information-security and merchant-oversight controls must be maintained. Provider approval or successful processing does not relieve the Partner of its own legal or contractual obligations.

Monitoring, records and audit

BouncePay may monitor volumes, values, acceptance rates, fraud indicators, complaints, chargebacks, wallet destinations, geography and material changes across the Partner Portfolio.

The Partner must notify BouncePay immediately of suspected fraud, data or credential compromise, regulator or scheme contact, material complaints, adverse media, licence restriction, ownership change or activity outside the Approved Business, and must supply requested investigation information within 24 hours where urgent and otherwise within two Business Days.

Records of onboarding, consent, orders, fulfilment, complaints and investigations must be retained for at least seven years. On reasonable notice, or immediately following a material risk event, BouncePay may audit relevant systems, records, websites and controls.

Provider dependency and relationship protection

The Services depend on Providers, including Banxa. Continued availability of any Provider, payment method, country, currency, asset, limit, rate or functionality is not guaranteed.

BouncePay may suspend or cease any or all processing immediately and without prior notice if a Provider suspends, restricts or terminates service; fraud, abuse, prohibited activity or material breach is reasonably suspected; requested information is not supplied; or continued processing could place BouncePay's Provider relationship, regulatory position, reputation or other partners at risk.

Where a Provider suspends, restricts or terminates BouncePay's facility because of conduct reasonably attributable to the Partner Portfolio, BouncePay may suspend all Services and withhold from sums otherwise payable an amount reasonably estimated to cover anticipated direct costs and Losses, as security pending investigation and remediation. Withheld amounts may be applied only against reasonable and documented compliance, investigation, technical, legal and Provider-remediation costs, and any unapplied balance must be released once the matter is resolved. This mechanism is security for anticipated direct costs and is not a fine or punitive penalty.

Commercial fees, invoices and taxes

The Partner must pay the fees stated in Schedule 5 and the incorporated Global Pricing Schedule, which may contain different rates by country, payment method, merchant category, volume, transaction value, fiat currency or settlement asset.

The applicable Global Pricing Schedule must be identified by title, version and effective date in Schedule 5 or otherwise accepted in writing. A replacement schedule applies only to future Transactions from its agreed effective date and never retrospectively.

If a Provider introduces or increases a mandatory provider, network, regulatory or blockchain cost, BouncePay may pass through that cost on written notice before it applies to future Transactions. Fees are exclusive of VAT and other applicable taxes, and amounts are payable without set-off except as required by law.

Fraud, chargebacks and Provider costs

Unless Schedule 5 expressly states otherwise, BouncePay will not charge the Partner scheme assessments, Provider fraud fees or underlying chargeback amounts that the Provider does not charge or recover from BouncePay.

That does not prevent recovery of direct Losses actually imposed on or incurred by BouncePay because of the Partner Portfolio's breach, fraud, unauthorised activity, misrepresentation or material failure to cooperate.

BouncePay may introduce reasonable prospective controls, limits, increased monitoring or security requirements if the Partner Portfolio's risk deteriorates. No fee may be imposed retrospectively.

Settlement, liquidity and service disruption

Where configured for Instant Settlement, BouncePay will cause the approved system to initiate settlement automatically after a Transaction is successfully completed, without waiting for a scheduled batch.

Instant Settlement describes the automated method of initiating settlement and is not a promise that funds or crypto assets will be received within a fixed number of seconds or minutes. Completion remains subject to Provider and MoR confirmation, compliance checks, available liquidity, blockchain confirmation and the receiving wallet or account remaining operational.

Settlement may be delayed, held, rejected or interrupted by blockchain congestion, forks, network or wallet failure, disrupted liquidity, banking or Provider outage, compliance or regulatory review, security events, sanctions controls or a hold imposed by an MoR, acquirer, bank or Provider. BouncePay does not custody funds or assets held by a Provider or MoR and has no obligation to pre-fund or make good a settlement delayed for reasons outside its reasonable control.

Merchant fulfilment, complaints and refunds

The Partner or Approved Submerchant is solely responsible for its products, services, fulfilment, delivery, warranties, cancellations, consumer rights, taxes and Customer support.

An executed Provider crypto-asset transaction may be irreversible or non-refundable. The Partner must not promise that Banxa or BouncePay can reverse an executed blockchain transfer, and must distinguish complaints about its own goods or services from complaints about the Provider transaction.

Data protection, security and confidentiality

Each party complies with Schedule 4 Part B and applicable data-protection law, including the GDPR where applicable, and acts as an independent controller for personal data it determines to process. The Partner warrants a lawful basis and transparent notices for disclosures to BouncePay, Banxa and relevant verification, payment, fraud-prevention and technology suppliers, including any required cross-border transfer mechanism.

Each party maintains appropriate technical and organisational security measures. The Partner must notify BouncePay without undue delay and, where practicable, within 24 hours of discovering an incident affecting the Services, Customer data or API credentials.

Each party keeps the other's non-public commercial, technical, security and Customer information confidential and uses it only to perform this Agreement, subject to permitted disclosures to personnel, advisers, Providers and authorities or where required by law.

Intellectual property, branding and warranties

Each party retains its pre-existing intellectual property. BouncePay grants a limited, revocable, non-transferable licence during the Term to use approved integration materials solely for the Approved Business. The Partner must not use Banxa's or BouncePay's name, marks or branding, issue publicity, imply endorsement or create a white-labelled representation except as expressly approved in writing, and must not reverse engineer or interfere with the Services.

Each party warrants it is duly organised and authorised. The Partner warrants that all information supplied is accurate, that it holds all licences required for the Approved Business, and that its products, services, marketing and Customer journey do not infringe third-party rights or mislead Customers.

Except as expressly stated, the Services are provided as available. BouncePay does not warrant uninterrupted operation, approval of any Transaction, a particular exchange rate, settlement time, acceptance level or commercial outcome.

Indemnities and limitation of liability

The Partner indemnifies BouncePay and its officers, employees and contractors against direct Losses arising from the Partner Portfolio's breach of this Agreement or law, fraud or prohibited activity, inaccurate order or wallet instructions, its products, services, fulfilment or marketing, a data or security breach attributable to it, infringement of third-party rights, or a claim, investigation or Provider action attributable to those matters. The indemnity is reduced to the extent a Loss was caused by BouncePay's breach, negligence, fraud or wilful misconduct. BouncePay indemnifies the Partner against direct Losses from third-party claims caused by BouncePay's IP infringement or data-security breach.

Neither party is liable for indirect or consequential loss, or for loss of profit, revenue, opportunity, goodwill or anticipated savings, except where those amounts form part of an indemnified third-party claim. BouncePay is not liable for a Provider's refusal, suspension, termination, repricing, removal of functionality, blockchain delay, banking interruption or regulatory action beyond its reasonable control.

Subject to the exclusions, each party's aggregate liability in any rolling 12-month period is limited to the total net fees actually received by BouncePay from the Partner during the preceding 12 months. No limitation excludes liability that cannot lawfully be limited, or liability for fraud, wilful misconduct, death or personal injury caused by negligence. The Partner's liability is not capped for fraud, wilful misconduct, confidentiality or data breach, IP infringement, regulatory penalties, amounts due, wallet-instruction losses or indemnified third-party claims.

Term, suspension and termination

This Agreement begins on the Agreement date and continues for the Initial Term of 12 months, then continues until either party gives 30 days' written notice.

BouncePay may suspend immediately or terminate on written notice if the Partner materially breaches and, if remediable, fails to remedy within five Business Days; a Provider requires suspension or termination; continued service may breach law or create material compliance or security risk; the Partner becomes insolvent; or suspected fraud or prohibited activity makes immediate action reasonable. The Partner may terminate if BouncePay fails to remedy a material breach within five Business Days after notice, or immediately if it cannot be remedied.

On termination the Partner must stop submitting Transactions, stop using API credentials and branding, and pay all accrued amounts. Termination does not affect completed Transactions, accrued rights or surviving provisions including confidentiality, data protection, fees, records, indemnities, liability, disputes and post-termination exposure.

Acceptable use (Schedule 4, Part A)

The Services must not be used for unlawful, fraudulent, deceptive, unauthorised or undisclosed activity. Prohibited categories include, without limitation: fraud, impersonation, stolen payment instruments, money laundering, terrorist financing or sanctions evasion; transaction laundering, undisclosed merchants, nested aggregation, inaccurate merchant descriptions or disguised beneficiaries; unlawful gambling, unlicensed financial or investment services or deceptive investment opportunities; counterfeit or infringing goods, illegal drugs, prohibited weapons, unlawful pharmaceuticals or unlawful adult content; activity likely to damage BouncePay, Banxa, a Provider, card network, bank or Customer; and any category, jurisdiction, asset, payment method or use notified by BouncePay as restricted or prohibited.

Where the Partner is uncertain whether activity is permitted, it must obtain written approval before submitting any Transaction.

Schedule 5 — Commercial Terms and Global Pricing Schedule

Schedule 5 is the commercial schedule to this Agreement. It records the currently applicable Global Pricing Schedule by title, version number and effective date, and is issued to the Partner separately once the Agreement is countersigned. Only a Global Pricing Schedule identified in Schedule 5, or otherwise accepted by the Partner in writing, applies to the Partner.

Schedule 5 and the incorporated Global Pricing Schedule set out: processing and orchestration fees; settlement and payout fees; FX and spread treatment; per-payment-method and per-country pricing; merchant-category and volume tiers; minimum transaction values and limits; blockchain, network and Provider pass-through costs; invoicing frequency, payment terms and currency; and any reserve, security-deposit or rolling-hold requirement applied at onboarding.

Pricing may differ by country, payment method, merchant category, volume, transaction value, fiat currency and settlement asset. This Agreement is not itself an offer of any specific price, and no pricing is agreed until a Global Pricing Schedule is identified in Schedule 5 or accepted in writing.

A replacement Global Pricing Schedule is issued as a new version with its own effective date and applies only to Transactions from that date forward. No pricing change applies retrospectively. Mandatory Provider, network, regulatory or blockchain cost increases may be passed through on written notice before they apply to future Transactions.

Where Schedule 5 is silent, BouncePay will not charge the Partner scheme assessments, Provider fraud fees or underlying chargeback amounts that the Provider does not charge or recover from BouncePay. On pricing matters, Schedule 5 and the Global Pricing Schedule prevail over the main terms; on Partner-type matters, the applicable Partner-Type Schedule prevails.

General

Notices are sent to the addresses in Schedule 1 and are deemed received on delivery, or the next Business Day if sent after 17:00 Cyprus time. Neither party may assign without consent, not to be unreasonably withheld, except that BouncePay may assign to an affiliate or as part of a bona fide reorganisation, financing or sale on written notice. Material obligations may not be subcontracted, and no sub-processor affecting the Services appointed, without prior written approval.

Neither party is liable for delay caused by events beyond reasonable control, except payment obligations already due. Invalid provisions are modified to the minimum extent required and the remainder continues. This Agreement is the entire agreement on its subject; amendments must be in writing and accepted by authorised representatives, except operational or compliance updates expressly permitted by this Agreement.

Electronic signatures and counterparts are valid, and a person accepting electronically warrants authority to bind the relevant party. This Agreement and non-contractual obligations arising from it are governed by Cyprus law, and the courts of Cyprus have exclusive jurisdiction, subject to urgent protective relief elsewhere.